MalwarePublished 5 Aug 2026

bigops-procedure-player (npm) · Malicious Code

Affects bigops-procedure-playerSource GCVE Database

Malicious package : remove bigops-procedure-player and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13234

What to do

Remove bigops-procedure-player from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-procedure-player	Affected =35.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-procedure-player npm package version 35.8.2 contains malicious code that dynamically loads and executes OS-specific binaries from suspicious external hosts. The payload is either fetched directly from runtime-constructed delivery hostnames or assembled from base64-encoded chunks retrieved via DNS TXT records. The binaries are saved to temporary system directories with filenames mimicking legitimate cache or diagnostic files, given executable permissions, and executed detached from the main process. This behavior is indicative of a malicious dropper designed to evade detection and persist on the host system.

Impact

This malicious code enables arbitrary code execution on affected systems by downloading and running OS-specific binaries from attacker-controlled infrastructure. The execution of these binaries under the guise of system cache or diagnostic files can lead to system compromise, persistence, and potential further malicious activity. Because the payload is fetched dynamically and can be assembled from DNS records, it may evade some network detection mechanisms.

Defensive guidance

Users should immediately avoid using bigops-procedure-player version 35.8.2 and remove it from their environments. Monitor for any suspicious processes or files matching the described patterns (e.g., temporary files named like system cache or diagnostic artifacts in /var/tmp or %TEMP%). Check for updates or advisories from the package publisher or npm registry. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages.

Summary

The bigops-procedure-player package (npm ecosystem) at version 35.8.2 includes a malicious loader in index.js that reconstructs delivery hostnames at runtime to fetch OS-specific binaries via HTTPS. If the direct fetch fails, it falls back to assembling the payload from base64 chunks stored in DNS TXT records under *.dl.wel1.ru. The payload is written to temporary files on Unix or Windows systems with executable permissions and launched detached from the main process. The filenames are crafted to resemble system cache or diagnostic artifacts. A similar dropper pattern exists in lib/telemetry.js but is not invoked in this version. The delivery hosts are unrelated to the package publisher, indicating a supply chain compromise or malicious package insertion.

References

npmjs.com/package/bigops-procedure-player/v/35.8.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:45 UTC

Technical details

References

Community reviews